Use your Android phone’s built-in security key to verify sign-in on iOS devices

Posted by Kaiyu Yan and Christiaan Brand
Compromised credentials are one of the most common causes of security breaches. While Google automatically blocks the majority of unauthorized sign-in attempts, adding 2-Step Verification (2SV) considerably improves account security. At Cloud Next ‘19, we introduced a new 2SV method, enabling more than a billion users worldwide to better protect their accounts with a security key built into their Android phones.
This technology can be used to verify your sign-in to Google and Google Cloud services on Bluetooth-enabled Chrome OS, macOS, and Windows 10 devices. Starting today, you can use your Android phone to verify your sign-in on Apple iPads and iPhones as well.
Security keys
FIDO security keys provide the strongest protection against automated bots, bulk phishing, and targeted attacks by leveraging public key cryptography to verify your identity and URL of the login page, so that an attacker can’t access your account even if you are tricked into providing your username and password. Learn more by watching our presentation from Cloud Next ‘19.

On Chrome OS, macOS, and Windows 10 devices, we leverage the Chrome browser to communicate with your Android phone’s built-in security key over Bluetooth using FIDO’s CTAP2 protocol. On iOS devices, Google’s Smart Lock app is leveraged in place of the browser.

User experience on an iPad with Pixel 3

Until now, there were limited options for using FIDO2 security keys on iOS devices. Now, you can get the strongest 2SV method with the convenience of an Android phone that’s always in your pocket at no additional cost.
It’s easy to get started
Follow these simple steps to protect your Google Account today:
Step 1: Add the security key to your Google Account

• Add your personal or work Google Account to your Android 7.0+ (Nougat) phone.
• Make sure you’re enrolled in 2-Step Verification (2SV).
• On your computer, visit the 2SV settings and click "Add security key".
• Choose your Android phone from the list of available devices.

Step 2: Use your Android phone's built-in security key

• On both of your devices, make sure Bluetooth is turned on.
• On your iPhone or iPad (iOS version 10.0 or up), sign in to your Google Account with your username and password using the Google Smart Lock app.
• Check your Android phone for a notification.
• Follow the instructions to confirm it’s you signing in.

You can find more detailed instructions here. Within enterprise organizations, admins can require the use of security keys for their users in G Suite and Google Cloud Platform (GCP), letting them choose between using a physical security key, an Android phone, or both.
We also recommend that you register a backup hardware security key (from Google or a number of other vendors) for your account and keep it in a safe place, so that you can gain access to your account if you lose your Android phone.